---
title: "Fortanix DSM as External KMIP in Rubrik"
slug: "fortanix-dsm-as-external-kmip-in-rubrik"
updated: 2026-08-19T15:15:14Z
published: 2026-08-19T15:15:14Z
canonical: "support.fortanix.com/fortanix-dsm-as-external-kmip-in-rubrik"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.fortanix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Fortanix DSM as External KMIP in Rubrik

## 1.0 Introduction

This article outlines the steps to configure and integrate the **Fortanix-Data-Security-Manager (DSM)** solution with Rubrik Cloud Data Management (CDM). The guidance provided will be valuable for users evaluating, designing, or implementing these technologies to enhance their data security management and streamline cloud data protection workflows.

## 2.0 KMIP and Certificate Requirements

The Key Management Interoperability Protocol (KMIP) is used to facilitate communication between the Rubrik cluster and Fortanix DSM. KMIP uses Transport Layer Security (TLS) to provide a secure connection and Fortanix DSM also uses this to authenticate a KMIP client to successfully create, retrieve, and use the keys stored inside Fortanix DSM.

The X.509 certificates are used to facilitate the communication and authentication for both Fortanix DSM and the Rubrik Cluster. Fortanix DSM is deployed with a server certificate that is signed by the internal Certificate Authority (CA).

The username and password from Fortanix DSM can be used for authenticating the Rubrik cluster, or alternatively, a client certificate for the Rubrik cluster can be created using tools such as OpenSSL. The certificate may be signed externally or can be self-signed.

### 2.2 Considerations

The following key points should be understood on the Fortanix DSM and Rubrik CDM integration:

- Once encryption is enabled at the cluster level in Rubrik CDM, it cannot then be disabled in the future.
- Rubrik CDM supports only one (1) external KMS at a time.
- Once a TLS connection with the Fortanix DSM has been established, Rubrik CDM maintains that connection unless services are restarted or stopped. This results in a persistent TLS connection.

## 3.0 Prerequisites

Ensure the following:

- Rubrik CDM version 5.3.0 or later is installed and operational.
- The Cluster is configured to use encryption.
  - Encryption can only be enabled at the cluster level during the bootstrap process.
- Fortanix DSM version 3.23 or later is installed and operational.
  - The Fortanix DSM is contactable by the Rubrik cluster on port 5696 or a custom KMIP port.
- Access to OpenSSL or another tool for generating a client certificate and private key in the Privacy Enhanced Mail (PEM) format.

## 4.0 Configure Fortanix DSM

A Fortanix DSM service must be configured, and the URL must be accessible. To create a Fortanix DSM account and group, refer to the following sections:

### 4.1 Signing Up

To get started with the Fortanix DSM cloud service, you must register an account at <Your_DSM_Service_URL>. For example, [https://amer.smartkey.io.](https://amer.smartkey.io.) On-premises customers use the KMS URL, and the SaaS customers can use the URLs as listed [*here*](https://support.fortanix.com/hc/en-us/articles/4406135346068-Fortanix-DSM-SaaS-Global-Availability-Map) based on the application region.

*For more information on how to set up the Fortanix DSM, refer to* [*Sign Up for Fortanix Data Security Manager SaaS*](https://support.fortanix.com/docs/users-guide-sign-up-for-fortanix-data-security-manager-saas)*.*

### 4.2 Creating an Account

Access <Your_DSM_Service_URL> in a web browser and enter your credentials to log in to Fortanix DSM.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/DSM_SaaS_Login_page(15).png)

**Figure 1: Logging in**

*For more information on how to set up an account in Fortanix DSM, refer to* [*Getting Started with Fortanix Data Security Manager - UI*](https://support.fortanix.com/docs/users-guide-getting-started-with-fortanix-data-security-manager-ui)*.*

### 4.3 Using On-Premises Deployment

#### 4.3.1 Creating a Group

Perform the following steps to create a group in the Fortanix DSM:

1. In the DSM left navigation panel, click the **Groups** menu item, and then click **ADD GROUP** to create a new group.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Add-Group(79).png)

**Figure 2: Add groups**
2. On the **Adding new group** page:
  1. **Title**: Enter a name for your group.
  2. **Description** (optional): Enter a short description of the group.
3. Click **SAVE** to create the new group.

*For more information about groups, refer to* [*Definitions*](/v1/docs/dsm-definitions#40-groups)*.*

> [!NOTE]
> TIP
> 
> It is recommended to configure a **Key undo policy** for groups for the cryptographic keys used by the application before creating or using the keys. Without a configured **Key undo policy**, key deletion is permanent and the deleted key cannot be recovered. Deleting an encryption key may result in permanent loss of access to the protected data and service disruption for applications that depend on the deleted key. *For detailed steps, refer to* [*Key Undo Policy*](/v1/docs/fortanix-dsm-key-undo-policy)*.*

#### 4.3.2 Creating an Application

Perform the following steps to create an application (app) in the Fortanix DSM:

1. In the DSM left navigation panel, click the **Apps** menu item, and then click **ADD APP** to create a new app.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/DSM_Add_App(2).png)

**Figure 3: Add application**
2. On the **Adding new app** page:
  1. **App name**: Enter the name for your application.
  2. **ADD DESCRIPTION** (optional): Enter a short description of the application.
  3. **Authentication method**: Select the default **API Key** as the authentication method from the drop down menu. *For more information on these authentication methods, refer to* [*Authentication*](/v1/docs/dsm-authentication)*.*
  4. **Assigning the new app to groups**: Select the group created in [*Section 4.3.1: Creating a Group*](/v1/docs/fortanix-dsm-as-external-kmip-in-rubrik#431-creating-a-group) [](/v1/docs/using-data-security-manager-with-idcentral-key-management#43-creating-a-group)from the list.
3. Click **SAVE** to add the new application.

/snip

#### 4.3.3 Copying the App UUID

Perform the following steps to copy the app UUID from the Fortanix DSM:

1. In the DSM left navigation panel, click the **Apps** menu item, and then click the app created in [*Section 4.3.2: Creating an Application*](/v1/docs/fortanix-dsm-as-external-kmip-in-rubrik#432-creating-an-application) [](/v1/docs/using-data-security-manager-with-idcentral-key-management#44-creating-an-application)to go to the detailed view of the app.
2. From the top of the app’s page, copy the app **UUID** to be used in [*Section 5.0: Extract Fortanix DSM CA Certificate*](/v1/docs/fortanix-dsm-as-external-kmip-in-rubrik#50-extract-fortanix-dsm-ca-certificate) as the value of Common Name (CN) to generate the Certificate Signing Request (CSR).

#### 4.3.4 Changing the Authentication Method

Perform the following steps to change the application authentication method to **Certificate**:

1. In the detailed view of the app, under the **INFO** tab, click **Change authentication method** from the drop down menu and select **Certificate** as the new authentication method for the app.
2. In the **Add Certificate** form, paste the generated certificate in the **Upload Certificate** text box. *To generate the certificate, refer to* [*Section 5.0: Extract Fortanix DSM CA Certificate*](/v1/docs/fortanix-dsm-as-external-kmip-in-rubrik#50-extract-fortanix-dsm-ca-certificate)*.*
3. Click **UPDATE** to update the app authentication method to the certificate.

### 4.4 Using SaaS Deployment

#### 4.4.1 Creating a Rubrik Instance

Perform the following steps to create an application (app) using the Rubrik wizard in Fortanix DSM SaaS:

1. Sign up at [https://smartkey.io/](https://smartkey.io/) to access DSM SaaS for the AMER region. DSM SaaS supports multiple regions, as listed [*here*](/v1/docs/fortanix-dsm-saas-global-availability-map).
2. Log in to the Fortanix DSM UI and click the **Integrations** menu item from the left panel.
3. On the **Integrations** page, search the **Rubrik wizard** and click **ADD INSTANCE**.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Storage-Encryption-Instances - Copy.png)

**Figure 4: Add rukbrik instance**
4. On the **Add Instance** page:

This action will automatically create an instance, a new group and app within the Fortanix DSM.
  1. **Instance Name:** Enter the required name to identify the instance created.
  2. **Authentication method:** Select either of the following option:

> [!NOTE]
> NOTE
> 
> Since you do not have a certificate, you must select the API key option as the authentication method to capture the UUID of the app.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/image-1768771742016.png)

**Figure 5: Add instance**
    1. **API key:** Select this option to authenticate the application with the API Gateway.
    2. **Client Certificate:** Select this option to authenticate the application with the Client Certificate. If you select this option, the **UPLOAD CERTIFICATE** field is enabled on the UI screen. Click **UPLOAD CERTIFCATE** to upload the certificate file from your system or paste the content of the certificate in the provided space.

#### 4.4.2 Rubrik Wizard Instance Detailed View

Navigate to the **Integrations** menu item → **Rubrik wizard** → Rubrik instances table. In the instance detailed view page, the following information is represented:

- **Credentials**: Indicates the method used for app authentication.
  - Click **CERTIFICATE** to download the Client Certificate. This is applicable only if the app authentication method is **Client Certificate**.
  - Click **VIEW API KEY DETAILS** to view the details of the API key, such as username and password. This is applicable only if the app authentication method is API Key.
- **Manage Keys**: Click **MANAGE** to oversee the keys created.
- **Instance status**: To disable the created instance, toggle **Disabled**.
- **DELETE**: To delete the instance, click the overflow menu ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Accounts_OverFlow(2).png) and select **DELETE**. Note that deleting an instance will result in the removal of the app, group, and all security objects associated with the instance, rendering all key material inaccessible.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/image-1768771650350.png)

**Figure 6: Instance details**

## 5.0 Extract Fortanix DSM CA Certificate

### 5.1 Through CLI Method

1. Log into a system that has OpenSSL, or equivalent, installed.
2. Enter the following OpenSSL command to display the certificates of Fortanix DSM:

```bash
openssl s_client -connect <dsm_hostname_or_ip>:5696 -showcerts
```

An example output is as follows:

![Rubrik_5.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/360091666091.png)

**Figure 7: Certificates**
3. Copy the output of the DSM Root certificate into a file and save it on a system that will be used to access the Rubrik user interface (UI).

![Rubrik 4.3.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/25676201873428.png)

**Figure 8: DSM root certificate output for EU region**

### 5.2 Through UI Method

The Fortanix DSM CA certificate can also be extracted from your local device/computer.

- Download the root CA certificate (and if exists the intermediate CA certificate) from the Web Browser that is pointing to the Fortanix DSM.
- Sample of the root and intermediate CA can be as follows:

![Rubrik_6.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/360091666371.png)

**Figure 9: Root CA and intermediate CA**
  - Root CA: DST Root CA
  - Intermediate CA: R3
- If not already in PEM format (such as DER), convert both the CA certificate information from the saved binary with the following OpenSSL command:

![Rubrik_7.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/360091666391.png)

**Figure 10: Enroll compute node**
- This must be added to the Rubrik CDM UI to configure the appropriate certificate settings for Fortanix DSM after creating the client certificate.

## 6.0 Create Client Certificate and Private Key (Optional)

If it is not desirable to use password-based authentication against Fortanix DSM, certificate-based authentication can be configured using client certificates.

There are two different types of client certificates:

- Self-signed Certificates: These are generated and signed by the end-user.
- Externally signed Certificates: These require a Certificate Signing Request generating and then must be signed by an external Trusted Certificate Authority (CA).

### 6.1 Generating Self-Signed Certificate and Private Key

To generate a self-signed certificate and private key for the Rubrik cluster:

1. Log in to a system with OpenSSL installed.
2. Use the `genrsa` command to generate the private key that will be written to the key filename and length specified.

![Rubrik_8.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/360091666491.png)

**Figure 11: Generate the private key**
3. Enter the following OpenSSL command to create the self-signed certificate as per customer security policy.

![Rubrik_9.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/360091676212.png)

**Figure 12: Create self-signed certificate**
4. Enter the following information:
  - **Country Name**: The two-letter country code
  - **State or Province Name**: The full state name
  - **City**: The full city name
  - **Organisation**: Full organisation name
  - **Organisational Unit**: Full department name
  - **Common Name**: The app UUID from the Fortanix DSM
  - **Others**: Optional
5. Ensure both the client certificate and private key are stored securely on the system.

![Rubrik_10.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/360091666571.png)

**Figure 13: Client cert and private key**

### 6.2 Generating an Externally Signed Certificate and Private Key

To sign a certificate from a trusted CA, you must first create a private key along with a certificate signing request:

1. Log in to a system with OpenSSL installed.
2. Use the `genrsa` command to generate the private key that will be written to the key filename and length specified.

![Rubrik_11.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/360091666591.png)

**Figure 14: Generate the private key**
3. Enter the following OpenSSL command to generate a CSR file as per customer security policy.

![Rubrik_12.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/360091676312.png)

**Figure 15: Generate private key**
4. Enter the following information:
  - **Country Name**: The two-letter country code
  - **State or Province Name**: The full state name
  - **City**: The full city name
  - **Organisation**: Full organisation name
  - **Organisational Unit**: Full department name
  - **Common Name**: The app UUID from the Fortanix DSM
  - **Others**: Optional
5. Ensure both the client certificate and private key are stored securely on the system.

![Rubrik_13.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/360091666631.png)

**Figure 16: Client certificate and private key**

## 7.0 Configure Rubrik CDM Key Management Settings

When the previous steps have all been completed, Rubrik CDM can then be configured to use Fortanix DSM as an external key manager.

### 7.1 Configuring Certificates within Rubrik

1. Log in to the CDM UI and navigate to **Settings** and **Certificate Management**.

![Rubrik_16.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/360091683652.png)

**Figure 17: CDM certificate management**
2. Create a new entry and import the saved CA certificate(s) for the DSM.

![Rubrik_17.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/360091675131.png)

**Figure 18: Import saved CA certificate**
3. Enter the following information:
  - **Display Name**: To identify the certificate in the UI
  - **Description**: This is optional.
  - **Certificate**: Paste the Fortanix DSM CA cert gathered earlier in this field.
  - **Key Type**: None - there is no private key required for this certificate.
4. If a client certificate is going to be used to authenticate against the Fortanix DSM, the client certificate also needs to be added here with the following information:

Now the required certificates have been added to Rubrik CDM and the Fortanix DSM can be configured as an external key manager.
  - **Display Name**: To identify the certificate in the UI.
  - **Description**: This is optional.
  - **Certificate**: Paste the client certificate in this field.
  - **Key Type**: Key.
  - **Key**: The private key for the client certificate.

### 7.2 Configuring Fortanix DSM as External Key Manager

Perform the following steps:

1. Log in to the CDM UI and browse to **Settings** then **Manage Encryption**.

![Rubrik_18.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/360091688792.png)

**Figure 19: Manage encryption**
2. Select **Configure Client Settings**.

![Rubrik_19.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/360091680651.png)

**Figure 20: Configure client settings**
3. Enter the required settings into the **Configure Client Settings** form for either client certificate authentication or username/password authentication.
4. For Client Certificate Authentication:

![Rubrik_20.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/360091681211.png)

**Figure 21: Enroll compute node**
  1. **Username**: Enter the app UUID from the Fortanix DSM.
  2. **TLS Certificate**: Select the client certificate as created in [*Section 6.0: Create Client certificate and Private Key*](/v1/docs/fortanix-dsm-as-external-kmip-in-rubrik#60-create-client-certificate-and-private-key-optional)*.*
5. For Username and Password Authentication:

![Rubrik_21.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/360091681271.png)

**Figure 22: Client settings**

![Rubrik_22.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/360091681311.png)

**Figure 23: Username/password**
  1. **Username**: Enter the app UUID from the Fortanix DSM.
  2. **Password**: Enter the app API key credentials from the Fortanix DSM.
6. Setup the Fortanix DSM as a KMIP Server:

![Rubrik_23.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/360091689952.png)

**Figure 24: Add KMIP server**
  1. **Server Address**: KMIP IP Address or Hostname.
  2. **Port**: KMIP Port (5696 is the default).
  3. **TLS Certificate**: The Fortanix DSM CA certificate.
7. Before using the KMIP server, the current keys must be rotated away from the internal KMS to generate a new key in the Fortanix DSM:

![Rubrik_24.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/360091681351.png)

**Figure 25: Rotate keys**
8. Ensure the keys have been rotated successfully.

![Rubrik_25.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/360091681371.png)

**Figure 26: Rotation successful**

### 7.3 Verifying Within Fortanix DSM

Once the external KMS has been successfully registered within CDM, the Fortanix DSM will show activity in the app logs, as follows:

![Rubrik_26.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/360091690132.png)

**Figure 27: Activity logs**

## 8.0 Summary

This document should provide the required information needed to configure Rubrik CDM to use Fortanix’s DSM for key management. *Further information can be found at* [*https://support.rubrik.com*](https://support.rubrik.com) *or* [*https://www.fortanix.com*](https://www.fortanix.com)*.*

Fortanix Data Security Manager (DSM) is the world’s first cloud service secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as other secrets such as passwords, API keys, tokens, or any blob of data. Your business-critical applications and containers can integrate with Fortanix DSM using legacy cryptographic interfaces (PKCS#11, CNG, and JCE) or using the native Fortanix DSM RESTful interface.

## Related

- [What KMIP coverage do we provide?](/what-kmip-coverage-do-we-provide.md)
- [Fortanix DSM with IBM Informix](/fortanix-dsm-with-ibm-informix.md)
- [Fortanix DSM with Nutanix](/fortanix-dsm-with-nutanix.md)